zphgfue.dll - Any insight? 2

[buho]

Hello.

First, if this group is not the right one, feel free to redirect me to any other group fitting my
needs.

My Windows 2000 Adv. Sever machine is loading (or may be trying to load) a so called zphgfue.dll.

I have an entry in the HKLM\...\Run key and another in the HKLM\...\RunOnce key, the last one marked with a "*" (so it loads in safe mode too). The DLL is not present in the machine.

-> "*zphgfue"="rundll32 C:\\WINNT\\system32:zphgfue.dll,Init 1"

The keys can't be deleted, as EXPLORER.EXE automatically re-creates it.

-> regedit.exe:964 DeleteValueKey HKLM\...\*zphgfue
. SUCCESS
-> explorer.exe:1096 SetValue HKLM\...\*zphgfue
. SUCCESS
. "rundll32 C:\WINNT\system32:zphgfue.dll,Init 1

Furthermore, any user have a zphgfue (no extension) file in D&S\user\...\temp. Said file is in use and can't be deleted. Deleting the file in a non logged user directory is possible, of course, but the file will be re-created in the next login.

The DLL appear to be accessed at least for mstha.exe and mdm.exe.

-> mshta.exe:1280 OPEN C:\WINNT\system32:zphgfue.dll
. SUCCESS Options: Open Access: Execute
-> mdm.exe:1628 OPEN C:\WINNT\system32:zphgfue.dll
. SUCCESS Options: Open Access: Execute

What is troubling me is:
a) I can't get any reference in the 'net
b) I have not said DLL, but the logs reports the accesses as "SUCCESS".
c) The ":" syntaxis in the parameters line (...system32:zphgfue.dll,Init 1)

Any insight/info/pointers will be pretty much appreciated.

TIA.
buho.

 

[buho]

Nearly one month later:

The keys vanished. They was there last week, they are not anywhere tonight.

Please, any clue, pointer, theory, whatever will be really appreciated. This thing is driven me mad.

buho (A).

 

[xmsre]

I'd hazard a guess that it's a trojan, virus, or some other malware. The format, file:name is a stream. Ntfs supports alternate data streams. The dll was hidden in an alternate data stream the system32 directory itself. Data in an alternate stream can be executed by calling it directly. One very real virus that took advantage of all this was W32.stream. Looks like you found a new variant.

http://www.sophos.com/virusinfo/analyses/w2kstream.html

The naming convention looks like coreflood-d.





Notepad is a stream aware application if you want to experiment....


At a command prompt, type notepad c:\test.txt:mystream

Click yes at the prompt.

Type your thesis, list of reasons why IBM Domino [arguably a virus itself] sucks, or other lengthy document.

Click save.

Close notepad.

change directories to c:\ and do a directory listing.

Note that test.txt is 0 bytes long.

open notepad

from the file menu, navagate to and select test.txt

note that the document is blank.

close notepad

from the command prompt, type notepad c:\test.txt:mystream

Your thesis is back.

 

[buho]

Thank you very much, xmsre!

buho (A).